CVE-2026-41940: critical vulnerability in WebPros cPanel
WebPros cPanel and WHM Authentication Bypass via Login Flow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.3epss 99%
from disclosure to weaponsame day
Published on NVDApr 29
1st PoCApr 29
metasploitApr 28
CISA KEV+1d
Action required by CISAfederal deadline: 2026-05-03
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
In short
cPanel and WHM have a flaw that lets attackers log in without valid credentials, giving them full control over hosting accounts and servers.
Technical detail
An authentication bypass in cPanel/WHM login flow (CWE-306) allows unauthenticated remote attackers to bypass credential validation and gain unauthorized access. The vulnerability affects versions after 11.40 and requires no special preconditions, resulting in complete compromise of the control panel.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
public PoCs found — 136
exploitdbwww.exploit-db.com/exploits/52574unverifiedgithubgithub.com/sakidekin/CVE-2026-41940-PoC★ 533githubgithub.com/lanicer/cve-2026-41940-PoC★ 532githubgithub.com/ctdal/cve-2026-41940-PoC★ 526githubgithub.com/ynsmroztas/cPanelSniper★ 511githubgithub.com/soverineg/cve-2026-41940-PoC★ 313githubgithub.com/pemarine/cve-2026-41940-PoC★ 272githubgithub.com/aquace/CVE-2026-41940-PoC★ 192githubgithub.com/assetnote/cpanel2shell-scanner★ 93githubgithub.com/XsanFlip/poc-cpanel-cve-2026-41940★ 63githubgithub.com/clsmight/CVE-2026-41940-PoC★ 62githubgithub.com/ZeroDayEvil/CVE-2026-41940-PoC★ 28githubgithub.com/adriyansyah-mf/cve-2026-41940-poc★ 28githubgithub.com/Sachinart/CVE-2026-41940-cpanel-0day★ 26githubgithub.com/bughunt4me/cpanelCVE-2026-41940★ 13githubgithub.com/ilmndwntr/CVE-2026-41940-MASS-EXPLOIT★ 13githubgithub.com/rfxn/cpanel-sessionscribe★ 13githubgithub.com/realawaisakbar/CVE-2026-41940-Exploit-PoC★ 12githubgithub.com/tc4dy/CVE-2026-41940-PoC-Exploit★ 12githubgithub.com/Kagantua/cPanelWHM-AuthBypass★ 10githubgithub.com/Kill1234545/CVE-2026-41940★ 10githubgithub.com/Christian93111/CVE-2026-41940★ 10githubgithub.com/0xYuR1/CVE-2026-41940★ 9githubgithub.com/murrez/CVE-2026-41940★ 8githubgithub.com/habibkaratas/sorry-ransomware-analysis★ 6githubgithub.com/debugactiveprocess/cPanel-WHM-AuthBypass-Session-Checker★ 6githubgithub.com/senyx122/CVE-2026-41940★ 6githubgithub.com/shahidmallaofficial/cpanel-cve-2026-41940-fix★ 4githubgithub.com/Jenderal92/CVE-2026-41940★ 4githubgithub.com/NULL200OK/cve-2026-41940-tool★ 3githubgithub.com/mahfuzreham/cpanel-cve-2026-41940★ 3githubgithub.com/44pie/cpsniper★ 2githubgithub.com/Andrei-Dr/cpanel-cve-2026-41940-ioc★ 2githubgithub.com/willygailo/CVE-2026-41940-Linux★ 2githubgithub.com/CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit★ 2githubgithub.com/merdw/cPanel-CVE-2026-41940-Scanner★ 2githubgithub.com/Ishanoshada/CVE-2026-41940-Exploit-PoC★ 2githubgithub.com/sardine-web/Automated-scanner-CVE-2026-41940★ 2githubgithub.com/MrOplus/CVE-2026-41940★ 1githubgithub.com/AmirrezaMarzban/portscan-CVE-2026-41940★ 1githubgithub.com/0xBlackash/CVE-2026-41940★ 1githubgithub.com/Defacto-ridgepole254/CVE-2026-41940-Exploit-PoC★ 1githubgithub.com/Lutfifakee-Project/CVE-2026-41940★ 1githubgithub.com/0xgh057r3c0n/CVE-2026-41940★ 1githubgithub.com/kmaruthisrikar/CVE-2026-41940-cPanel-Auth-Bypass-Exploit★ 1githubgithub.com/zedxod/CVE-2026-41940-POC★ 1githubgithub.com/george1-adel/CVE-2026-41940_exploit★ 1githubgithub.com/linko-iheb/cve-2026-41940-scanner★ 1githubgithub.com/nickpaulsec/2026-41940-poc★ 1githubgithub.com/razureink/cve-2026-41940-cpanel_authbypass_reproduction★ 1githubgithub.com/thekawix/CVE-2026-41940★ 1githubgithub.com/ashrafzaryouh/CVE-2026-41940★ 1githubgithub.com/AnotherSec/CVE-2026-41940★ 1githubgithub.com/0xabdoulaye/CPANEL-CVE-2026-41940★ 1githubgithub.com/Unfold-Security/CVE-2026-41940-Detection★ 1githubgithub.com/keithbennedict/CVE-2026-41940-Linux★ 0githubgithub.com/3tternp/CVE-2026-41940---cPanel-WHM-check★ 0githubgithub.com/acuciureanu/cpanel2shell-honeypot★ 0githubgithub.com/SreejaPuthan/cpanel-control-plane-exposure-check★ 0githubgithub.com/oguz-kagan-akar/CVE-2026-41940-analysis★ 0githubgithub.com/yanchenyu360/CVE-2026-41940-Security-Patch★ 0githubgithub.com/t4xo/CVE-2026-41940★ 0githubgithub.com/MrAriaNet/cPanel-Fix★ 0githubgithub.com/dennisec/CVE-2026-41940★ 0githubgithub.com/yasouxken/cve-2026-41940-PoC★ 0githubgithub.com/limo57640-crypto/cpanel-cve-41940-detector★ 0githubgithub.com/xxconi/CVE-2026-41940★ 0githubgithub.com/yurahshell/CVE-2026-41940★ 0githubgithub.com/rdyprtmx/poc-cve-2026-41940★ 0githubgithub.com/Underh0st/CPanel-Audit-Remediation-Tool★ 0githubgithub.com/zwanski2019/cPanelSniper★ 0githubgithub.com/itsismarcos/CVE-2026-41940★ 0githubgithub.com/ZildanZ/CVE-2026-41940★ 0githubgithub.com/dann3xplo1t/Cpanel★ 0githubgithub.com/devtint/CVE-2026-41940★ 0githubgithub.com/vineet7800/cpanel-malware-cleaner-cve-2026★ 0githubgithub.com/Rosemary1337/CVE-2026-41940★ 0githubgithub.com/imbas007/POC_CVE-2026-41940★ 0githubgithub.com/tfawnies/CVE-2026-41940-next★ 0githubgithub.com/iSee857/cPanel-WHM-CVE-2026-41940-AuthBypass★ 0githubgithub.com/Richflexpix/cpanel-pwn★ 0githubgithub.com/ryhnmhrdka/CVE-2026-41940★ 0githubgithub.com/unteikyou/CVE-2026-41940-AuthBypass-Detector★ 0githubgithub.com/0dev1337/cpanelscanner★ 0githubgithub.com/sercanokur/CVE-2026-41940-cPanel-WHM-Verification-Tool★ 0githubgithub.com/OhmGun/whmxploit---CVE-2026-41940★ 0githubgithub.com/branixsolutions/Security-CVE-2026-41940-cPanel-WHM-WP2★ 0githubgithub.com/ngksiva/cpanel-forensics★ 0githubgithub.com/Xrzmodz444/cve-2026-41940-PoC-Linux★ 0githubgithub.com/hitechcloud-vietnam/cve-2026-41940-PoC★ 0githubgithub.com/ylerpeek/CVE-2026-41940-PoC-3★ 0githubgithub.com/anach-ai/CVE-2026-41940★ 0githubgithub.com/Wesuiliye/CVE-2026-41940★ 0githubgithub.com/asdasddqwdq29-a11y/CVE-2026-41940★ 0vulncheckvulncheck.com/xdb/ab4932c439e3unverifiedvulncheckvulncheck.com/xdb/79c0a2242820unverifiedvulncheckvulncheck.com/xdb/c5929b7843f1unverifiedvulncheckvulncheck.com/xdb/0760f33ef8feunverifiedcve_referencegithub.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyunverifiedvulncheckvulncheck.com/xdb/638c0484e819unverifiedvulncheckvulncheck.com/xdb/ee294b4613eaunverifiedvulncheckvulncheck.com/xdb/16d5ab800560unverifiedvulncheckvulncheck.com/xdb/822ef40705bcunverifiedvulncheckvulncheck.com/xdb/de3f8fdecbe3unverifiedvulncheckvulncheck.com/xdb/e2b42e6bcdd2unverifiedvulncheckvulncheck.com/xdb/99c465956adaunverifiedvulncheckvulncheck.com/xdb/7ac5e6841496unverifiedvulncheckvulncheck.com/xdb/2d059995e5c8unverifiedvulncheckvulncheck.com/xdb/61b014f224a5unverifiedvulncheckvulncheck.com/xdb/915262813837unverifiedvulncheckvulncheck.com/xdb/698f92dd7818unverifiedvulncheckvulncheck.com/xdb/c8e41f933cc2unverifiedvulncheckvulncheck.com/xdb/b5918a180562unverifiedvulncheckvulncheck.com/xdb/9c08a4d28b74unverifiedvulncheckvulncheck.com/xdb/8cd860ca73cdunverifiedvulncheckvulncheck.com/xdb/7a76757220caunverifiedvulncheckvulncheck.com/xdb/f9d342e4eca2unverifiedvulncheckvulncheck.com/xdb/3b0962dac909unverifiedvulncheckvulncheck.com/xdb/661bf0d571c6unverifiedvulncheckvulncheck.com/xdb/f8cff31d8055unverifiedvulncheckvulncheck.com/xdb/7f33a13eae8funverifiedvulncheckvulncheck.com/xdb/3e9a7043f1c8unverifiedvulncheckvulncheck.com/xdb/6ccec66d3309unverifiedvulncheckvulncheck.com/xdb/8667179e485cunverifiedvulncheckvulncheck.com/xdb/a327d1cb48afunverifiedvulncheckvulncheck.com/xdb/633f3f2da3d5unverifiedvulncheckvulncheck.com/xdb/6553a2321f70unverifiedvulncheckvulncheck.com/xdb/7dd127bc3b48unverifiedvulncheckvulncheck.com/xdb/e157f5d69e1eunverifiedvulncheckvulncheck.com/xdb/0701db1fa28dunverifiedvulncheckvulncheck.com/xdb/448e559dab0bunverifiedvulncheckvulncheck.com/xdb/b8f96da8a016unverifiedvulncheckvulncheck.com/xdb/e3c91bcbf5d4unverifiedvulncheckvulncheck.com/xdb/66cfb91c6e16unverifiedvulncheckvulncheck.com/xdb/aca42fa8ca62unverifiedvulncheckvulncheck.com/xdb/02ab4edb040bunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WebPros cPanel
In the same product, most dangerous first.
References
https://docs.cpanel.net/release-notes/release-noteshttps://docs.wpsquared.com/changelogs/versions/changelog/#13617https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyhttps://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow